Last updated: 24 May 2021
These Data Processing Terms (“Terms”) shall apply, and shall be incorporated into our agreement with you (“the Advertiser”), where Auto Trader (or its sub-contractor) will be required to process personal data, acting as a data processor on your behalf, in connection with the provision of Auto Trader products or services to you. This will apply, for example (but without limitation), if you subscribe to, use or are otherwise provided with access to AT Calls, AT Analytics and/or Sales Insight.
Please read these Terms in conjunction with the Main Advertising Terms & Conditions and the relevant Business Rules that set out further terms relating to the provision and use of the specific Auto Trader products or services.
Terms defined in the Main Advertising Terms & Conditions shall have the same meaning in these Terms provided that, should a term be defined in both the Main Advertising Terms & Conditions and these Terms, the meaning of the term defined in these Terms shall have precedence in relation to these Terms.
- “Applicable Laws” means (for so long as and to the extent that they apply to Auto Trader or the Sub-processor, as applicable) the law of the European Union, the law of any member state of the European Union and/or Domestic UK Law; and “Domestic UK Law” means the Data Protection Laws and any other law that applies in the UK;
- “Data Protection Laws” means all applicable data protection and privacy legislation in force form time to time in the UK including the UK GDPR; the Data Protection Act 2018; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) (all as amended, updated or re-enacted from time to time);
- “Standard Contractual Clauses” or “SCC” means the European Commission's Standard Contractual Clauses for the transfer of Personal Data from the European Union to processors established in third countries (controller-to-processor transfers), as set out in the Annex to Commission Decision 2010/87/EU;
- “Sub-processor(s)” means Auto Trader’s third-party processor(s) of personal data, which shall be as detailed in the Business Rules that relate to the relevant Auto Trader product or service (as updated from time to time);
- “UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act of 2018; and
- The terms “controller”, “processor”, “personal data”, “data subject”, “Personal Data Breach” and “processing shall have the meaning set out in the Data Protection Laws (and “process” and “processed” shall be construed accordingly).
Data Processing Clauses
- Each of the Advertiser and Auto Trader shall comply with all applicable requirements of the Data Protection Laws (as a controller or processor, as applicable). This Clause 2 is in addition to, and does not relieve, remove or replace, a party’s obligations under the Data Protection Laws.
- Neither the Advertiser nor Auto Trader shall through its acts or omissions place the other party in breach of any Data Protection Legislation.
- The parties acknowledge that for the purposes of the Data Protection Laws, the Advertiser is the controller and Auto Trader is the processor. Details of the processing of personal data being undertaken by Auto Trader (or, as applicable, its Sub-processor on its behalf) shall be set out in the Business Rules that relate to the relevant Auto Trader product or service.
Without prejudice to the generality of Clause 2.1, the Advertiser will ensure that it has all
necessary appropriate consents and notices in place to enable (as applicable):
- the lawful transfer of the personal data to Auto Trader and/or it’s Sub-processor(s); and/or
- the lawful collection of the personal data by Auto Trader and/or its Sub-processor(s),
Without prejudice to the generality of Clause 2.1, Auto Trader shall (and, as applicable, shall
procure that its Sub-processor shall), in relation to any personal data processed in connection with
the performance by Auto Trader (or, as applicable, its Sub-processor) of its obligations under the
- process that personal data only for the purpose of providing the Auto Trader products or services in accordance with the Advertising Agreement and the relevant Business Rules (and any other written instructions of the Advertiser, as notified to Auto Trader in advance from time to time), unless Auto Trader (or, as applicable, the Sub-processor) is required to process such personal data otherwise by Applicable Laws. Where Auto Trader (or, as applicable, the Sub-processor) is relying on Applicable Laws as the basis for processing personal data, Auto Trader (or, as applicable, the Sub-processor) shall promptly notify the Advertiser of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit the Auto Trader (or, as applicable, the Sub-processor) from so notifying the Advertiser;
- ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures;
- ensure that all personnel (including, without limitation, employees) who have access to and/or process personal data are legally obliged to keep the personal data confidential;
subject to clause 2.6, not transfer any personal data outside of the UK or the European Economic Area
unless the prior written consent of the Advertiser has been obtained and the following
conditions are fulfilled:
- the Advertiser or Auto Trader has provided appropriate safeguards in relation to the transfer;
- the data subject has enforceable rights and effective legal remedies; and
- Auto Trader complies with its obligations under the Data Protection Laws by providing an adequate level of protection to any personal data that is transferred;
- assist the Advertiser, at the Advertiser’s cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
- notify the Advertiser without undue delay on becoming aware of any Personal Data Breach or other security incident affecting or relating to personal data;
- subject to anything stated specifically otherwise in the Business Rules that relate to the relevant Auto Trader product or service, at the written direction of the Advertiser, delete or return personal data and all copies thereof to the Advertiser on termination of the Advertising Agreement or at any other time unless required by Applicable Law to store the personal data; and
- maintain complete and accurate records and information to demonstrate its compliance with this Clause 2 and relevant provisions of the Data Protection Laws; and
- undertake regular audits (i.e. at least annually) of its internal compliance with its obligations under these Terms and the Data Protection Laws. On request, Auto Trader shall provide the Advertiser with a copy of its findings from the audit and the Advertiser shall be entitled to raise with Auto Trader any concerns that it has arising from the findings. Auto Trader will work with the Advertiser in good faith to try to find a reasonable resolution to any reasonable and genuine concerns of the Advertiser.
The Advertiser acknowledges and agrees that the Sub-processor(s) may be required to transfer personal data to a country or territory outside of the UK or the European Economic Area (“EEA”), such agreement being conditional on either:
- the Sub-processor transferring personal data to a country or territory which is subject to a current finding by the European Commission under the Data Protection Laws that the territory provides adequate protection for the privacy rights of individuals (“adequacy decision”); or
- where the Sub-processor is transferring personal data to a country or territory which is not subject to an adequacy decision, Auto Trader and/or the Sub-processor (as applicable) participating in a valid cross-border transfer mechanism under the Data Protection Laws, as required by Article 46 of the General Data Protection Regulation ((EU) 2016/679). To the extent that it is required, the Advertiser authorises Auto-Trader and/or the Sub-processor (acting on the Advertiser’s behalf) to enter into the SCC with the third-party sub-processor in the relevant country or territory. Auto Trader will procure that the executed SCC is made available to the Advertiser on request.
- The Advertiser consents to Auto Trader appointing the Sub-processor(s) as a third-party processor(s) of personal data under the Advertising Agreement. Auto Trader shall notify the Advertiser of any changes to the Sub-processors from time to time by updating the Business Rules that relate to the relevant Auto Trader product or service. Auto Trader confirms that it has entered into or (as the case may be) will enter into a written agreement with the third-party processor, which agreement shall contain provisions which comply with the Data Protection Laws. As between the Advertiser and Auto Trader, Auto Trader shall remain fully liable for all acts or omissions of any third-party processor appointed by it pursuant to this Clause 2.7.